Threat Hunting Tools

Blog

Sigma in 2026: what three releases added, and how a shared rule reaches your data

Rule releases as hunt prompts, and the path from generic rule to tested query.

By Threat Hunting Tools staff · · 4 min read

Most detection logic is written for one platform. Sigma exists so that it does not have to be. The project describes itself as a "generic and open signature format" for log events, and its repository holds more than 3,000 rules. Rules are written once and converted into the query language of the platform where they will run.

What did the 2026 releases add?

The Sigma project names releases by version and publishes them on GitHub. The release dates below are publication dates from the releases page; the version names carry the first day of the quarter.

  • r2026-01-01, published 29 January 2026: 33 new detection rules, with emphasis on EDR evasion and abuse of vulnerable drivers.
  • r2026-04-01, published 28 April 2026: 54 new rules and improvements to more than 60 existing detections, with a focus on NPM package compromises and credential access.
  • r2026-07-01, published 9 July 2026: 20 new detection rules and updates to more than 80 existing rules, including coverage of supply-chain attacks.

Taken together, the year so far has put weight on attacks against the software supply chain, on credential access and on attempts to evade or disable endpoint tooling. Those are summaries of the release notes, not an analysis of attacker trends; the notes themselves are the reference.

How can a hunter use a release?

Treat each release as a list of hunt prompts. For every new rule that touches a technique you care about:

  1. Read the rule, not just its title. Note the log source it expects, the fields it checks and the false positives it lists.
  2. Check whether you collect that log source, and for how long. If not, record a data gap in your hunt log.
  3. Convert the rule for your platform.
  4. Run it against past data as a hunt, over the longest window your retention allows.
  5. Review the results. A match is a lead to investigate; no match over a long window is a documented negative.
  6. If it is worth keeping, tune it and promote it to a detection, following from hunt to detection rule.

Running a new rule as a hunt first is the same idea as a backtest: see what it would have found before it starts raising alerts. Our post on backtesting and retrohunts covers how to read the output.

How does a generic rule reach your platform?

Through conversion. The Sigma project provides pySigma, a Python library, and the Sigma CLI to translate rules into the query languages of specific platforms. Conversion is not always one to one. Field names in the rule have to match the field names in your data, and some platforms need a mapping for that. Check a converted query by reading it, and by running it on data where you know what it should find.

This translation step is also where commercial tools do work of their own. Mars Security's September 2026 press release, for example, says it writes queries in the native query language of each source. When you evaluate any tool, ask whether it can import Sigma rules and how it handles field mapping. Our review for this edition did not record Sigma support for the tools covered in this post, so ask directly rather than assume.

What about the license?

The Sigma repository states that its rules are published under the Detection Rule License (DRL) 1.1. Read the license text in the repository before redistributing rules or building them into a product. Using a rule inside your own environment is the common case, but the license is the reference, not this post.

Where does Sigma sit next to newer formats?

Sigma describes detection logic. Newer open work is appearing at the agent layer: in August 2026 Vega released Detection Skills, an open specification built on the Agent Skills format with a library of more than 50 skills. The two address different layers, one the rule and the other how an agent carries out detection tasks. For a hunter, Sigma remains the shared format for the logic itself.

A short routine for each release

  • Read the release notes when they appear on the SigmaHQ releases page.
  • Pick the rules that match your priority techniques and your data.
  • Run each as a hunt over past data and log the result.
  • Promote the ones that earn it, with an owner and a test record.

Sources

Related

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18